On June 10, the decentralized finance (DeFi) protocol UwU Lend suffered a significant security breach, resulting in nearly $20 million in stolen digital assets.

The exploit, initially discovered by on-chain security firm Cyvers, was first reported when $14 million had been taken. Cyvers alerted UwU Lend in a post on X, stating, “Hey @UwU_Lend, you are being attacked! So far address got around $14M…”

UwU Lend operates as a liquidity market where users can deposit and borrow digital assets. Within an hour of the initial alert, the unknown hacker had stolen over $20 million.

Meir Dolev, CTO and co-founder of Cyvers, indicated that multiple assets, including WBTC and DAI, were drained from the pools and converted to ETH. The attack was funded by the crypto mixing protocol Tornado Cash and involved three malicious transactions executed within six minutes.

This incident is part of a broader trend of increasing cryptocurrency theft. In the first quarter of 2024, hackers stole $542.7 million worth of digital assets, a 42% increase from the same period in 2023. The rising valuation of cryptocurrencies has attracted more malicious actors, according to Mriganka Pattnaik, co-founder and CEO of Merkle Science. Pattnaik noted that while smart contract vulnerabilities remain a concern, attackers are increasingly targeting areas like private key leaks, often due to phishing attacks or insecure storage practices, leading to significant losses.